Of course. We got lucky this time, it was just a robot, which is easy to fend off with robots.txt. But what if it was a user who did the same thing?
Dynamic URLs? Maybe.
[Edit: When I say "dynamic", I mean dynamic to the current session, as you would see in a continuation based framework. I do not mean dynamic as it relates to a piece of data.]